CoM-c2itall/tasks/configure_mail.yml

---
# Common task for configuring mail server
# Shared across all providers

- name: Configure Postfix main.cf
  lineinfile:
    path: /etc/postfix/main.cf
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
  with_items:
    - { regexp: '^myhostname', line: "myhostname = mail.{{ domain }}" }
    - { regexp: '^mydomain', line: "mydomain = {{ domain }}" }
    - { regexp: '^myorigin', line: "myorigin = $mydomain" }
    - { regexp: '^inet_interfaces', line: "inet_interfaces = all" }
    - { regexp: '^inet_protocols', line: "inet_protocols = ipv4" }
    - { regexp: '^smtpd_banner', line: "smtpd_banner = $myhostname ESMTP $mail_name" }
    - { regexp: '^mynetworks', line: "mynetworks = 127.0.0.0/8 [::1]/128" }
    - { regexp: '^relay_domains', line: "relay_domains = $mydestination" }
    - { regexp: '^smtpd_tls_cert_file', line: "smtpd_tls_cert_file = /etc/letsencrypt/live/{{ domain }}/fullchain.pem" }
    - { regexp: '^smtpd_tls_key_file', line: "smtpd_tls_key_file = /etc/letsencrypt/live/{{ domain }}/privkey.pem" }
    - { regexp: '^smtpd_tls_security_level', line: "smtpd_tls_security_level = encrypt" }
    - { regexp: '^smtpd_tls_session_cache_database', line: "smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache" }
    - { regexp: '^smtp_tls_session_cache_database', line: "smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache" }
    - { regexp: '^smtpd_use_tls', line: "smtpd_use_tls = yes" }
    - { regexp: '^smtpd_tls_auth_only', line: "smtpd_tls_auth_only = yes" }
    - { regexp: '^milter_default_action', line: "milter_default_action = accept" }
    - { regexp: '^milter_protocol', line: "milter_protocol = 6" }
    - { regexp: '^smtpd_milters', line: "smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }
    - { regexp: '^non_smtpd_milters', line: "non_smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock" }

- name: Configure OpenDKIM
  lineinfile:
    path: /etc/opendkim.conf
    regexp: "{{ item.regexp }}"
    line: "{{ item.line }}"
  with_items:
    - { regexp: '^Domain', line: "Domain   {{ domain }}" }
    - { regexp: '^KeyFile', line: "KeyFile /etc/opendkim/keys/{{ domain }}/mail.private" }
    - { regexp: '^Selector', line: "Selector mail" }
    - { regexp: '^Socket', line: "Socket   local:/var/spool/postfix/opendkim/opendkim.sock" }
    - { regexp: '^Syslog', line: "Syslog   yes" }
    - { regexp: '^UMask', line: "UMask    002" }
    - { regexp: '^Mode', line: "Mode     sv" }

- name: Create DKIM directory
  file:
    path: /etc/opendkim/keys/{{ domain }}
    state: directory
    owner: opendkim
    group: opendkim
    mode: 0700

- name: Generate DKIM keys
  command: >
    opendkim-genkey -D /etc/opendkim/keys/{{ domain }} -d {{ domain }} -s mail
  args:
    creates: /etc/opendkim/keys/{{ domain }}/mail.private

- name: Set permissions for DKIM keys
  file:
    path: /etc/opendkim/keys/{{ domain }}/mail.private
    owner: opendkim
    group: opendkim
    mode: 0600

- name: Configure OpenDKIM TrustedHosts
  copy:
    content: |
      127.0.0.1
      ::1
      localhost
      {{ domain }}
    dest: /etc/opendkim/TrustedHosts
    owner: opendkim
    group: opendkim
    mode: 0644

- name: Enable submission port (587) in master.cf
  blockinfile:
    path: /etc/postfix/master.cf
    insertafter: '^#submission'
    block: |
      submission     inet  n       -       y       -       -       smtpd
        -o syslog_name=postfix/submission
        -o smtpd_tls_security_level=encrypt
        -o smtpd_sasl_auth_enable=yes
        -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
        -o smtpd_relay_restrictions=permit_sasl_authenticated,reject

- name: Configure Dovecot for Postfix SASL
  blockinfile:
    path: /etc/dovecot/conf.d/10-master.conf
    insertafter: '^service auth {'
    block: |
      # Postfix smtp-auth
      unix_listener /var/spool/postfix/private/auth {
        mode = 0660
        user = postfix
        group = postfix
      }

- name: Set Dovecot auth_mechanisms
  lineinfile:
    path: /etc/dovecot/conf.d/10-auth.conf
    regexp: '^auth_mechanisms'
    line: 'auth_mechanisms = plain login'

- name: Create Dovecot password file for SASL authentication
  file:
    path: /etc/dovecot/passwd
    state: touch
    mode: '0600'
    owner: dovecot
    group: dovecot

- name: Add SMTP auth user to Dovecot
  lineinfile:
    path: /etc/dovecot/passwd
    line: "{{ smtp_auth_user }}:{{ smtp_auth_pass | password_hash('sha512_crypt') }}"

- name: Disable system auth and use passwd-file
  lineinfile:
    path: /etc/dovecot/conf.d/10-auth.conf
    regexp: '^!include auth-system.conf.ext'
    line: '#!include auth-system.conf.ext'

- name: Add auth-passwdfile configuration
  blockinfile:
    path: /etc/dovecot/conf.d/10-auth.conf
    insertafter: '^auth_mechanisms ='
    block: |
      passdb {
        driver = passwd-file
        args = scheme=sha512_crypt /etc/dovecot/passwd
      }
      userdb {
        driver = static
        args = uid=vmail gid=vmail home=/var/vmail/%u
      }

- name: Create vmail group
  group:
    name: vmail
    gid: 5000
    state: present

- name: Create vmail user
  user:
    name: vmail
    uid: 5000
    group: vmail
    create_home: no

- name: Create vmail directory structure
  file:
    path: /var/vmail
    state: directory
    owner: vmail
    group: vmail
    mode: 0700

- name: Restart Postfix
  service:
    name: postfix
    state: restarted

- name: Restart Dovecot
  service:
    name: dovecot
    state: restarted